---
# Source: cilium/templates/cilium-agent/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium"
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium-operator"
  namespace: kube-system
---
# Source: cilium/templates/cilium-ca-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: cilium-ca
  namespace: kube-system
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUlKWGRJMHFGRllibnBWUWlISUM2Rm93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEl6TURVeE1ERTFNekV6TTFvWERUSTJNRFV3T1RFMQpNekV6TTFvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF0RGw5YzZXVFJjSTNNbGR2SEFrUDdSUmRjL3YyUGpoMkxVU28xVGREUFYzU2R0MHkKM2xWenk4NU9DaTYvQUxkVGtNTVFNczJnTVdIclRuU1FxVXpiYXRFMDBac3Z5Q25uM3VERU02VytaV05YVWI4cgpjMUJCSW5jSmRvMWxTNmVTamt6VHZoYWZGa01VZHRVRnVYd2RVRjloK1hsQ015Z1piWEJlSk9XUkFzRVVYVXhTCm5Dbkx4U3B4Uk4wVjMvUXVRN3FuczBiS0JlRHplVU92YjBWYTNvaXIvMFhmV1hhOWlQdlpkeERWc1o5bTJsQXoKSzlaUmExSVQ2WUx0bkVQcU5GbUNDMkFFZTIrMVFDM1p4OFRsamkwRjFJWXpwRzYzbzRLOHEvZ29pdXBWcnBSagpDbHlMVTNqczVncE9LZGZISUFHK0h5bGNGRkpDTDB3SVFDV3Fud0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSk9jeGdyQTM0NWs4U2tLcURoSUhOSmxWTGJvTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQ2RZZVQ3eGNoSWlieVNoWE5NOUplOU9mVUxUT1lDc01XeEp4Y3J1bzBja0hjdUt3SWFDM01OCkRLVE1halhNNGJpSHcvVDN0clNEL2ZrQWV0ekozcW9rR2MzS3dNYzBmVlhrZWJma0JhMTNLUHZNV3JEYXh6MXQKem9YeVVHUnRlV1Z6NXAyVWJVYkJNY0RFME55MlpGdWRLNW5XRzJESGFZMjQ0SHJzNUV5WnRtNFFlSzIyL2hNNwppa2c3QVRMT2lVd3pLV3pmbStmMndUZUVycmw5U3JCNVZZOGpZN0pZRmR0NzFqZDZYR3hDNmpFbitlT0N0RnA2CnU2b1BqQzBJSVhpcnFFM2JhYkdBQzNrY2VubnowdGQraW5ud1E3dms3NEE5TUNFYmFzTWRIcHV5b2c5ajFycGsKbXVWbTRWR3JXQVVHY2MzeEhielZueWoxMzVDVmRRYXYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBdERsOWM2V1RSY0kzTWxkdkhBa1A3UlJkYy92MlBqaDJMVVNvMVRkRFBWM1NkdDB5CjNsVnp5ODVPQ2k2L0FMZFRrTU1RTXMyZ01XSHJUblNRcVV6YmF0RTAwWnN2eUNubjN1REVNNlcrWldOWFViOHIKYzFCQkluY0pkbzFsUzZlU2prelR2aGFmRmtNVWR0VUZ1WHdkVUY5aCtYbENNeWdaYlhCZUpPV1JBc0VVWFV4UwpuQ25MeFNweFJOMFYzL1F1UTdxbnMwYktCZUR6ZVVPdmIwVmEzb2lyLzBYZldYYTlpUHZaZHhEVnNaOW0ybEF6Cks5WlJhMUlUNllMdG5FUHFORm1DQzJBRWUyKzFRQzNaeDhUbGppMEYxSVl6cEc2M280SzhxL2dvaXVwVnJwUmoKQ2x5TFUzanM1Z3BPS2RmSElBRytIeWxjRkZKQ0wwd0lRQ1dxbndJREFRQUJBb0lCQUFoWDZRRGpsMi9SVC9EYQpyMkFpNDBQY2YzOFJHUk5FVmVRK20zcFRkcDl1cW9HcU4rS25IaGMvVThtUTVITEtDZXBYdlhZOG9yL21ncGc5Ck9UMDlPNk0wVURlcjhZaFl1RTFQSm9ZbGxDenBibTl3WkRpUWJKT0Y0MEJEeDM2N0lVUEpOcnhFRzlWU0FhNkcKcWg4dUtjVkF4UzVoZUxrWmtDUEs0ZkRmVjlsQ3R5VTdnb3RkZWJodmdtcmlGZmZSZGI0MHBTN1pNRTUrYit5UwpCYUlGM3BxcFlERGQ0SkdEVHhWOGp0aGN0NnZuKzZWN2pGSTBwVDN3a3Z0UCtzRlJzRkdaNWxBYXpCMERzd1UyCkZ0R1lpNTV6Y2dDMUNPT3kyWStoR2xyeTY4Q09zbmp6WkV6aTFQbGtGWGFHbzloM3pvVWx5WHZxTFE5ZmpuR1gKVFFrdnJ6RUNnWUVBMWNpRnhhVUd1VnU4cm4rYXhWbTZWWVdBOVlrc3ZwZTZEbFVnb2h6ZjlPZC8zWGRxWmt3RgozQU92MkNSY3dja2NNVlBRb2x2dWI3N1hPK0lzK1NiTnQzL3NJRjgwTDJQeS9pQlk5aDM5TGhsQ3UvVzhYZy9JClpnMlg5WFRiWDZBWEFrZkVzUVNuMUp1cng4ZC8vTkFkUXkwbCticWEzNjdBUzhVcjdqRVFPeTBDZ1lFQTE5QjEKa1VkMldFaVdNSmlxWFRCZzNhcEhsZHRESDRudkFKQWs1Q1JlUWZtOGRUMURJck9za2MwM1k2RUswSVhTRGhUKwpwM0lxYXRKTDJqdG1VWUJrclo0aUg5dXFqRi9tQTlTa2RFL2pTakJQcStkT3JZWW9xTXFES2huUGI3QzhkUU50Ck5NaUZlWEVCREprM1FtZ2FIWnBueDUvUlppakVSRWc2Tks1VHJIc0NnWUJIcDFRZThMY1dQWWM2UFk3VWdzU1AKa1pXdHRuS0cxemdIUWNVVVVQVkhrcWdxeExHbTQrZzYzQWwrT29IVWVlRzNMczZJL0tNb1ZTQ3k4NVg3VkdRegpFdTlEMG1VZFZUVEd0SFRjMlNSWTVTS1crVUJQanA2dWhmUGUwM0lMMVE2aE53allCQ1YwZjFET1B6SEl2TUJ5Ckdablc0QkswMGsrbGxjcXBwVXc1YVFLQmdHUlo4SEV2YzU0MWtuRGliRVdNMjEzM2NmWUMwTUYzbUFVQkFjWjgKQ3NCTzZnenlBYWUvT0gxTG1YZmdTSEVSNk16WGdscEdRZWNPQm10aHQ0QXFYYVpGbzhTQWxsdFR0RmNQcDdEVgovUEJnYW91YXNRRUxJeGpwb2ZnUHJGOVpKU2ljQVVuTC9CU3VNVGkwZmZlSkJLdkRRb0tXay80VzhyeDFnV3RCCnJITEZBb0dBQm9yUDNJK1l2Y1p1cXk0K2VGd0JXUDFDS1ZSNjZkNW5DWktNR2VMdW90UmcrNmlta2VyY3pNWlAKQ29MdkZMbGl0VkQyUzluemZVRHBzYXVhb1JqK2tmalNvWnV0QVBWOGdPRjBTMHdxcU0yOFgxL29YK1MwRGxpSwpXQWxtMkR1WXNxTEtKVjFCRDlCcUIxUW1mVmRIZmtPVktTOTZUSytkVWJFVGVBMzJSaU09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
---
apiVersion: v1
kind: Secret
metadata:
  name: hubble-ca-secret
  namespace: kube-system
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUlKWGRJMHFGRllibnBWUWlISUM2Rm93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEl6TURVeE1ERTFNekV6TTFvWERUSTJNRFV3T1RFMQpNekV6TTFvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF0RGw5YzZXVFJjSTNNbGR2SEFrUDdSUmRjL3YyUGpoMkxVU28xVGREUFYzU2R0MHkKM2xWenk4NU9DaTYvQUxkVGtNTVFNczJnTVdIclRuU1FxVXpiYXRFMDBac3Z5Q25uM3VERU02VytaV05YVWI4cgpjMUJCSW5jSmRvMWxTNmVTamt6VHZoYWZGa01VZHRVRnVYd2RVRjloK1hsQ015Z1piWEJlSk9XUkFzRVVYVXhTCm5Dbkx4U3B4Uk4wVjMvUXVRN3FuczBiS0JlRHplVU92YjBWYTNvaXIvMFhmV1hhOWlQdlpkeERWc1o5bTJsQXoKSzlaUmExSVQ2WUx0bkVQcU5GbUNDMkFFZTIrMVFDM1p4OFRsamkwRjFJWXpwRzYzbzRLOHEvZ29pdXBWcnBSagpDbHlMVTNqczVncE9LZGZISUFHK0h5bGNGRkpDTDB3SVFDV3Fud0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSk9jeGdyQTM0NWs4U2tLcURoSUhOSmxWTGJvTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQ2RZZVQ3eGNoSWlieVNoWE5NOUplOU9mVUxUT1lDc01XeEp4Y3J1bzBja0hjdUt3SWFDM01OCkRLVE1halhNNGJpSHcvVDN0clNEL2ZrQWV0ekozcW9rR2MzS3dNYzBmVlhrZWJma0JhMTNLUHZNV3JEYXh6MXQKem9YeVVHUnRlV1Z6NXAyVWJVYkJNY0RFME55MlpGdWRLNW5XRzJESGFZMjQ0SHJzNUV5WnRtNFFlSzIyL2hNNwppa2c3QVRMT2lVd3pLV3pmbStmMndUZUVycmw5U3JCNVZZOGpZN0pZRmR0NzFqZDZYR3hDNmpFbitlT0N0RnA2CnU2b1BqQzBJSVhpcnFFM2JhYkdBQzNrY2VubnowdGQraW5ud1E3dms3NEE5TUNFYmFzTWRIcHV5b2c5ajFycGsKbXVWbTRWR3JXQVVHY2MzeEhielZueWoxMzVDVmRRYXYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBdERsOWM2V1RSY0kzTWxkdkhBa1A3UlJkYy92MlBqaDJMVVNvMVRkRFBWM1NkdDB5CjNsVnp5ODVPQ2k2L0FMZFRrTU1RTXMyZ01XSHJUblNRcVV6YmF0RTAwWnN2eUNubjN1REVNNlcrWldOWFViOHIKYzFCQkluY0pkbzFsUzZlU2prelR2aGFmRmtNVWR0VUZ1WHdkVUY5aCtYbENNeWdaYlhCZUpPV1JBc0VVWFV4UwpuQ25MeFNweFJOMFYzL1F1UTdxbnMwYktCZUR6ZVVPdmIwVmEzb2lyLzBYZldYYTlpUHZaZHhEVnNaOW0ybEF6Cks5WlJhMUlUNllMdG5FUHFORm1DQzJBRWUyKzFRQzNaeDhUbGppMEYxSVl6cEc2M280SzhxL2dvaXVwVnJwUmoKQ2x5TFUzanM1Z3BPS2RmSElBRytIeWxjRkZKQ0wwd0lRQ1dxbndJREFRQUJBb0lCQUFoWDZRRGpsMi9SVC9EYQpyMkFpNDBQY2YzOFJHUk5FVmVRK20zcFRkcDl1cW9HcU4rS25IaGMvVThtUTVITEtDZXBYdlhZOG9yL21ncGc5Ck9UMDlPNk0wVURlcjhZaFl1RTFQSm9ZbGxDenBibTl3WkRpUWJKT0Y0MEJEeDM2N0lVUEpOcnhFRzlWU0FhNkcKcWg4dUtjVkF4UzVoZUxrWmtDUEs0ZkRmVjlsQ3R5VTdnb3RkZWJodmdtcmlGZmZSZGI0MHBTN1pNRTUrYit5UwpCYUlGM3BxcFlERGQ0SkdEVHhWOGp0aGN0NnZuKzZWN2pGSTBwVDN3a3Z0UCtzRlJzRkdaNWxBYXpCMERzd1UyCkZ0R1lpNTV6Y2dDMUNPT3kyWStoR2xyeTY4Q09zbmp6WkV6aTFQbGtGWGFHbzloM3pvVWx5WHZxTFE5ZmpuR1gKVFFrdnJ6RUNnWUVBMWNpRnhhVUd1VnU4cm4rYXhWbTZWWVdBOVlrc3ZwZTZEbFVnb2h6ZjlPZC8zWGRxWmt3RgozQU92MkNSY3dja2NNVlBRb2x2dWI3N1hPK0lzK1NiTnQzL3NJRjgwTDJQeS9pQlk5aDM5TGhsQ3UvVzhYZy9JClpnMlg5WFRiWDZBWEFrZkVzUVNuMUp1cng4ZC8vTkFkUXkwbCticWEzNjdBUzhVcjdqRVFPeTBDZ1lFQTE5QjEKa1VkMldFaVdNSmlxWFRCZzNhcEhsZHRESDRudkFKQWs1Q1JlUWZtOGRUMURJck9za2MwM1k2RUswSVhTRGhUKwpwM0lxYXRKTDJqdG1VWUJrclo0aUg5dXFqRi9tQTlTa2RFL2pTakJQcStkT3JZWW9xTXFES2huUGI3QzhkUU50Ck5NaUZlWEVCREprM1FtZ2FIWnBueDUvUlppakVSRWc2Tks1VHJIc0NnWUJIcDFRZThMY1dQWWM2UFk3VWdzU1AKa1pXdHRuS0cxemdIUWNVVVVQVkhrcWdxeExHbTQrZzYzQWwrT29IVWVlRzNMczZJL0tNb1ZTQ3k4NVg3VkdRegpFdTlEMG1VZFZUVEd0SFRjMlNSWTVTS1crVUJQanA2dWhmUGUwM0lMMVE2aE53allCQ1YwZjFET1B6SEl2TUJ5Ckdablc0QkswMGsrbGxjcXBwVXc1YVFLQmdHUlo4SEV2YzU0MWtuRGliRVdNMjEzM2NmWUMwTUYzbUFVQkFjWjgKQ3NCTzZnenlBYWUvT0gxTG1YZmdTSEVSNk16WGdscEdRZWNPQm10aHQ0QXFYYVpGbzhTQWxsdFR0RmNQcDdEVgovUEJnYW91YXNRRUxJeGpwb2ZnUHJGOVpKU2ljQVVuTC9CU3VNVGkwZmZlSkJLdkRRb0tXay80VzhyeDFnV3RCCnJITEZBb0dBQm9yUDNJK1l2Y1p1cXk0K2VGd0JXUDFDS1ZSNjZkNW5DWktNR2VMdW90UmcrNmlta2VyY3pNWlAKQ29MdkZMbGl0VkQyUzluemZVRHBzYXVhb1JqK2tmalNvWnV0QVBWOGdPRjBTMHdxcU0yOFgxL29YK1MwRGxpSwpXQWxtMkR1WXNxTEtKVjFCRDlCcUIxUW1mVmRIZmtPVktTOTZUSytkVWJFVGVBMzJSaU09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
---
apiVersion: v1
kind: Secret
metadata:
  name: hubble-server-certs
  namespace: kube-system
type: kubernetes.io/tls
data:
  ca.crt:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUlKWGRJMHFGRllibnBWUWlISUM2Rm93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEl6TURVeE1ERTFNekV6TTFvWERUSTJNRFV3T1RFMQpNekV6TTFvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF0RGw5YzZXVFJjSTNNbGR2SEFrUDdSUmRjL3YyUGpoMkxVU28xVGREUFYzU2R0MHkKM2xWenk4NU9DaTYvQUxkVGtNTVFNczJnTVdIclRuU1FxVXpiYXRFMDBac3Z5Q25uM3VERU02VytaV05YVWI4cgpjMUJCSW5jSmRvMWxTNmVTamt6VHZoYWZGa01VZHRVRnVYd2RVRjloK1hsQ015Z1piWEJlSk9XUkFzRVVYVXhTCm5Dbkx4U3B4Uk4wVjMvUXVRN3FuczBiS0JlRHplVU92YjBWYTNvaXIvMFhmV1hhOWlQdlpkeERWc1o5bTJsQXoKSzlaUmExSVQ2WUx0bkVQcU5GbUNDMkFFZTIrMVFDM1p4OFRsamkwRjFJWXpwRzYzbzRLOHEvZ29pdXBWcnBSagpDbHlMVTNqczVncE9LZGZISUFHK0h5bGNGRkpDTDB3SVFDV3Fud0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSk9jeGdyQTM0NWs4U2tLcURoSUhOSmxWTGJvTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQ2RZZVQ3eGNoSWlieVNoWE5NOUplOU9mVUxUT1lDc01XeEp4Y3J1bzBja0hjdUt3SWFDM01OCkRLVE1halhNNGJpSHcvVDN0clNEL2ZrQWV0ekozcW9rR2MzS3dNYzBmVlhrZWJma0JhMTNLUHZNV3JEYXh6MXQKem9YeVVHUnRlV1Z6NXAyVWJVYkJNY0RFME55MlpGdWRLNW5XRzJESGFZMjQ0SHJzNUV5WnRtNFFlSzIyL2hNNwppa2c3QVRMT2lVd3pLV3pmbStmMndUZUVycmw5U3JCNVZZOGpZN0pZRmR0NzFqZDZYR3hDNmpFbitlT0N0RnA2CnU2b1BqQzBJSVhpcnFFM2JhYkdBQzNrY2VubnowdGQraW5ud1E3dms3NEE5TUNFYmFzTWRIcHV5b2c5ajFycGsKbXVWbTRWR3JXQVVHY2MzeEhielZueWoxMzVDVmRRYXYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWakNDQWo2Z0F3SUJBZ0lRZE9sVlh6T0dnY1FjdW85dGJ5Y1FVREFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nak13TlRFd01UVXpNVE16V2hjTk1qWXdOVEE1TVRVegpNVE16V2pBcU1TZ3dKZ1lEVlFRRERCOHFMbVJsWm1GMWJIUXVhSFZpWW14bExXZHljR011WTJsc2FYVnRMbWx2Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBcjRwWkk2azNkbXJPZy9JcS9SMnUKRmJJNHRMRkR1bi8vN2hIZk1KQ1FheVRFVTV4cW5HTGJLeTV0OG1YcFRyQW14My9HQ3VzNS9MaE1oemo5M0c3Tgo1YzhTVEMyTjlKYlkrM2N5YWMxbjlxNjA2anU0TDBFdEk5dytzRDl4Q3FqVk9BTU9BREIrS21sUUlhODZSTlhmCnNtVUdRdk41NVV4cTZvYUpYWUVTTk81Vkk1cGwrTkQxdDR2bHR2Y3p5NmY5YzcwUm5GYWlPUGtNZjc2RUVQNE4KM284d0tQejVLdWh2Qk56Kzc1RjM3YWZhdVcxQlZPNkRBMzlDWU1yNFJFZTN2YzBPN2d1M3pWWFNaUmJCRTZqKwpsY0xpMWhkSExLNGVDblB2REd1bVNaenBCTkg2ckNyUmh4d1lzQzI3amtacUxlUmlVaStiN3ZZYTVPM1dxZVN0CmFRSURBUUFCbzRHTk1JR0tNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0QKQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JTVG5NWUt3TitPWlBFcApDcWc0U0J6U1pWUzI2REFxQmdOVkhSRUVJekFoZ2g4cUxtUmxabUYxYkhRdWFIVmlZbXhsTFdkeWNHTXVZMmxzCmFYVnRMbWx2TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBUjRJRkVjOFRNczRYSG9HY2F1VUYxMksxL3ZxZmQKNHRTZGw0WlZ5U29QY1k4QXpESGN5U09pMmxzRnlxTDZtcThJekZSbVM5MHJXNVVobFJ4ZkZoU3p6WEtmQ3hseQpuN3YwMmljaTFmb21NRSt5clZwbU51OGxRTDRxQ2RNdXh1ZDNyTEl4Y29ZeTB1N3NFaERENEVxTjBUcGR0b1diClhhYkpRVHBRSW52OXl0S2Qwb3ppa2orV1JoNE5UaUdQc3g3bjEyNkVqekdON05XdjNOWjhoK3RRMVFMODFSTkYKd2toVVh2Ykl3Y0plcUV4ZlB2NTU0YUhDZUlEVHNzdTFaU2RHcHBWL3dTbHRjbi9aOEJySk14UHlxaGwzdkhVegp6ZXdLZXJrcWwyR1ljNUQzeWl1VnZsVFJ5a24wTEdRdFNpNFFuRmZ3TitEYjFwRE92Rlg2ckptOAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBcjRwWkk2azNkbXJPZy9JcS9SMnVGYkk0dExGRHVuLy83aEhmTUpDUWF5VEVVNXhxCm5HTGJLeTV0OG1YcFRyQW14My9HQ3VzNS9MaE1oemo5M0c3TjVjOFNUQzJOOUpiWSszY3lhYzFuOXE2MDZqdTQKTDBFdEk5dytzRDl4Q3FqVk9BTU9BREIrS21sUUlhODZSTlhmc21VR1F2TjU1VXhxNm9hSlhZRVNOTzVWSTVwbAorTkQxdDR2bHR2Y3p5NmY5YzcwUm5GYWlPUGtNZjc2RUVQNE4zbzh3S1B6NUt1aHZCTnorNzVGMzdhZmF1VzFCClZPNkRBMzlDWU1yNFJFZTN2YzBPN2d1M3pWWFNaUmJCRTZqK2xjTGkxaGRITEs0ZUNuUHZER3VtU1p6cEJOSDYKckNyUmh4d1lzQzI3amtacUxlUmlVaStiN3ZZYTVPM1dxZVN0YVFJREFRQUJBb0lCQUVFMU9tRzE1V1YyelpwVQpKa1g2ZFlXWHU5cmJrcFpBSURrMnFGc3BDSXpVanAya21ESFp3eUtxVDZ0ZzBpY3A1bTNyZUF6c1RwRWpnVUltCkdKOS9CYnRkamFXQXNwL3VQVkpFZUJTM2VldzMvL3FYRHBkM05hYUJsVVB4ZlRPQmZoc2RmMkR3b3Axc201aTMKdUFTRUVtSDVoemJ0clJWUnF0SE9BazhhdUVHeXZUUVgraURPZFgxMUZzY3ZraTU3Z0MrUGYrTGVUMmF2UGJTdwpQVENJUE1pK24yUTNxOXprQlFPQWUyd2FMYmsxUC8vYU11Y25LeHpxa29CVG02b1hEbHBvT092Q0xIa28rWkpjClhOM1JscFBCbCsxdjZ2YWlPeWozVnpCR0tEWDVWWDRpMFFPWHVaeXVoSjlkQXN1L3pyOG52OEZNWnFGN0VDY0IKdExuYS9BRUNnWUVBNVF1cENpamFMYjQzNWx1eFlKdlRWaDl6eTlpTDUxcTVrbEYzNHgrcmFScmVoWEdZNmw5ZApwZG91N21FK1E4UVplbjBGSy9zTnFFRGpSK0dSaitPV2JjTnlzSUw2MzhobWxxNC9XRHNERDV2YTZqOG9neWhSCkVMNlI4dFE1ckdhMTZqQUYxQ25aVmE0dmlldWhGN1Y5akF5aXRmdE5Pa0ZVVk4vd3pTMjVzWUVDZ1lFQXhETEUKRmtrK1lNdnlsd0llWGUySW8vbGlDdGV5R1l6QnJSajdpZXFHZTFLdnFwem0wVGlNRHljR25kWU9NKzFLeFFGRwptc2RWWDhKcHJhNm9scGkyS2R2VXVVc2VZcWIybGg5K0VVSytyczZVbU5Ca0dxQ2g0M3dVb0ZRY09aYUFYcVRDClpxWTdReW9jNTZBRENFM1EzV0k2Qk5PdVFjYUR6RE90dzNJam4ra0NnWUVBM1U3Tjd4WVg4WmpZOUVobWM5MDgKYnZ1RzdGQjRwWHNnMFFMTW52U3JyNnVabEVCMXF3ZW9PYWMrTDNCZ05DUVhKaVlFU0VHVUtaMUF2ZVJ5dkIvLwo2bUN0d1dWZE43cXZmU294NUhOb2VyMXg0V0pUSjU5ZDdKcmw5RVlnejdhU1VReERwWU1tRHNaMkFvSmNyY2JiCjN1VWFsbEdSaGhjM2Y2YTlTZExEbUlFQ2dZQkx6UEZGU3ZiMm50VVMwcGE0NDFTdlJXSkRuaUlKRFFDbXg4Z20KK0owTWVGMjJKUGhvVE5pUDRod0VUdmNkeU1maVpTUEtHTWs3UGZsbVNOeUprbWFPdFlmeUxydUdrY3NqSlBlbgo0NG1ZTCtmcFFsbnFqN1Q4RnF4QlpUMmlZaXNtWmJGVngxT09GMjhqYmdhOTVwS1RkYWZFeGFQRmRkVGx4L0dTCldUNjZRUUtCZ1FDclk1WE02UVVBUXZ6b0lzQW8zT2YvRjhEa3M4Sk4wcm1DeDVtTlY4elllb253bTJRRzMra0QKSit6NHY5VXFaKzJ0QWdFZWcrNnEwVG5tQnBnUjlRUWlxV3VyQmJ6QmQ2VkxvMFdMcFA5Q2lzUHV6TWU1Y245SwpTVmY3ajJnalBHZnM2TXMxU3NXUjFvNGhpVFVGSWhWSU1jSVlqNGhueHVlaFNaNHlnUitYU1E9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
---
# Source: cilium/templates/cilium-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:

  # Identity allocation mode selects how identities are shared between cilium
  # nodes by setting how they are stored. The options are "crd" or "kvstore".
  # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
  #   These can be queried with:
  #     kubectl get ciliumid
  # - "kvstore" stores identities in an etcd kvstore, that is
  #   configured below. Cilium versions before 1.6 supported only the kvstore
  #   backend. Upgrades from these older cilium versions should continue using
  #   the kvstore by commenting out the identity-allocation-mode below, or
  #   setting it to "kvstore".
  identity-allocation-mode: crd
  identity-heartbeat-timeout: "30m0s"
  identity-gc-interval: "15m0s"
  cilium-endpoint-gc-interval: "5m0s"
  nodes-gc-interval: "5m0s"
  skip-cnp-status-startup-clean: "false"
  # Disable the usage of CiliumEndpoint CRD
  disable-endpoint-crd: "false"

  # If you want to run cilium in debug mode change this value to true
  debug: "false"
  debug-verbose: ""
  # The agent can be put into the following three policy enforcement modes
  # default, always and never.
  # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes
  enable-policy: "default"

  # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  # address.
  enable-ipv4: "true"

  # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  # address.
  enable-ipv6: "false"
  # Users who wish to specify their own custom CNI configuration file must set
  # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
  custom-cni-conf: "false"
  enable-bpf-clock-probe: "true"
  # If you want cilium monitor to aggregate tracing for packets, set this level
  # to "low", "medium", or "maximum". The higher the level, the less packets
  # that will be seen in monitor output.
  monitor-aggregation: medium

  # The monitor aggregation interval governs the typical time between monitor
  # notification events for each allowed connection.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-interval: "5s"

  # The monitor aggregation flags determine which TCP flags which, upon the
  # first observation, cause monitor notifications to be generated.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-flags: all
  # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
  bpf-map-dynamic-size-ratio: "0.0025"
  # bpf-policy-map-max specifies the maximum number of entries in endpoint
  # policy map (per endpoint)
  bpf-policy-map-max: "16384"
  # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
  # backend and affinity maps.
  bpf-lb-map-max: "65536"
  bpf-lb-external-clusterip: "false"

  # Pre-allocation of map entries allows per-packet latency to be reduced, at
  # the expense of up-front memory allocation for the entries in the maps. The
  # default value below will minimize memory usage in the default installation;
  # users who are sensitive to latency may consider setting this to "true".
  #
  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  # this option and behave as though it is set to "true".
  #
  # If this value is modified, then during the next Cilium startup the restore
  # of existing endpoints and tracking of ongoing connections may be disrupted.
  # As a result, reply packets may be dropped and the load-balancing decisions
  # for established connections may change.
  #
  # If this option is set to "false" during an upgrade from 1.3 or earlier to
  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  preallocate-bpf-maps: "false"

  # Regular expression matching compatible Istio sidecar istio-proxy
  # container image names
  sidecar-istio-proxy-image: "cilium/istio_proxy"

  # Name of the cluster. Only relevant when building a mesh of clusters.
  cluster-name: default
  # Unique ID of the cluster. Must be unique across all conneted clusters and
  # in the range of 1 and 255. Only relevant when building a mesh of clusters.
  cluster-id: "0"

  # Encapsulation mode for communication between nodes
  # Possible values:
  #   - disabled
  #   - vxlan (default)
  #   - geneve
  tunnel: "{{ cilium.network_mode }}"


  # Enables L7 proxy for L7 policy enforcement and visibility
  enable-l7-proxy: "true"

  enable-ipv4-masquerade: "true"
  enable-ipv6-big-tcp: "false"
  enable-ipv6-masquerade: "true"

  enable-xt-socket-fallback: "true"
  install-no-conntrack-iptables-rules: "false"

  auto-direct-node-routes: "false"
  enable-local-redirect-policy: "false"

  kube-proxy-replacement: "disabled"
  bpf-lb-sock: "false"
  enable-health-check-nodeport: "true"
  node-port-bind-protection: "true"
  enable-auto-protect-node-port-range: "true"
  enable-svc-source-range-check: "true"
  enable-l2-neigh-discovery: "true"
  arping-refresh-period: "30s"
  cni-uninstall: "true"
  enable-endpoint-health-checking: "true"
  enable-health-checking: "true"
  enable-well-known-identities: "false"
  enable-remote-node-identity: "true"
  synchronize-k8s-nodes: "true"
  operator-api-serve-addr: "127.0.0.1:9234"
  # Enable Hubble gRPC service.
  enable-hubble: "true"
  # UNIX domain socket for Hubble server to listen to.
  hubble-socket-path: "/var/run/cilium/hubble.sock"
  # An additional address for Hubble server to listen to (e.g. ":4244").
  hubble-listen-address: ":4244"
  hubble-disable-tls: "false"
  hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
  hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
  hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
  ipam: "cluster-pool"
  cluster-pool-ipv4-cidr: "{{ kubernetes.pods_subnet }}"
  cluster-pool-ipv4-mask-size: "{{ kubernetes.node_prefix }}"
  disable-cnp-status-updates: "true"
  enable-vtep: "false"
  vtep-endpoint: ""
  vtep-cidr: ""
  vtep-mask: ""
  vtep-mac: ""
  enable-bgp-control-plane: "false"
  procfs: "/host/proc"
  bpf-root: "/sys/fs/bpf"
  cgroup-root: "/run/cilium/cgroupv2"
  enable-k8s-terminating-endpoint: "true"
  enable-sctp: "false"
  remove-cilium-node-taints: "true"
  set-cilium-is-up-condition: "true"
  unmanaged-pod-watcher-interval: "15"
  tofqdns-dns-reject-response-code: "refused"
  tofqdns-enable-dns-compression: "true"
  tofqdns-endpoint-max-ip-per-hostname: "50"
  tofqdns-idle-connection-grace-period: "0s"
  tofqdns-max-deferred-connection-deletes: "10000"
  tofqdns-min-ttl: "3600"
  tofqdns-proxy-response-max-delay: "100ms"
  agent-not-ready-taint-key: "node.cilium.io/agent-not-ready"
---
# Source: cilium/templates/cilium-agent/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
  labels:
    app.kubernetes.io/part-of: cilium
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  - pods
  - endpoints
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
  # This is used when validating policies in preflight. This will need to stay
  # until we figure out how to avoid "get" inside the preflight, and then
  # should be removed ideally.
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumloadbalancerippools
  - ciliumbgppeeringpolicies
  - ciliumclusterwideenvoyconfigs
  - ciliumclusterwidenetworkpolicies
  - ciliumegressgatewaypolicies
  - ciliumendpoints
  - ciliumendpointslices
  - ciliumenvoyconfigs
  - ciliumidentities
  - ciliumlocalredirectpolicies
  - ciliumnetworkpolicies
  - ciliumnodes
  - ciliumnodeconfigs
  verbs:
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumidentities
  - ciliumendpoints
  - ciliumnodes
  verbs:
  - create
- apiGroups:
  - cilium.io
  # To synchronize garbage collection of such resources
  resources:
  - ciliumidentities
  verbs:
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpoints
  verbs:
  - delete
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes
  - ciliumnodes/status
  verbs:
  - get
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/status
  - ciliumendpoints/status
  - ciliumendpoints
  verbs:
  - patch
---
# Source: cilium/templates/cilium-operator/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
  labels:
    app.kubernetes.io/part-of: cilium
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
  # to automatically delete [core|kube]dns pods so that are starting to being
  # managed by Cilium
  - delete
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  # To remove node taints
  - nodes
  # To set NetworkUnavailable false on startup
  - nodes/status
  verbs:
  - patch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  # to perform LB IP allocation for BGP
  - services/status
  verbs:
  - update
  - patch
- apiGroups:
  - ""
  resources:
  # to check apiserver connectivity
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  # to perform the translation of a CNP that contains `ToGroup` to its endpoints
  - services
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumclusterwidenetworkpolicies
  verbs:
  # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'
  - create
  - update
  - deletecollection
  # To update the status of the CNPs and CCNPs
  - patch
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/status
  verbs:
  # Update the auto-generated CNPs and CCNPs status.
  - patch
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpoints
  - ciliumidentities
  verbs:
  # To perform garbage collection of such resources
  - delete
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumidentities
  verbs:
  # To synchronize garbage collection of such resources
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes
  verbs:
  - create
  - update
  - get
  - list
  - watch
    # To perform CiliumNode garbage collector
  - delete
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes/status
  verbs:
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpointslices
  - ciliumenvoyconfigs
  verbs:
  - create
  - update
  - get
  - list
  - watch
  - delete
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - create
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - update
  resourceNames:
  - ciliumloadbalancerippools.cilium.io
  - ciliumbgppeeringpolicies.cilium.io
  - ciliumclusterwideenvoyconfigs.cilium.io
  - ciliumclusterwidenetworkpolicies.cilium.io
  - ciliumegressgatewaypolicies.cilium.io
  - ciliumendpoints.cilium.io
  - ciliumendpointslices.cilium.io
  - ciliumenvoyconfigs.cilium.io
  - ciliumexternalworkloads.cilium.io
  - ciliumidentities.cilium.io
  - ciliumlocalredirectpolicies.cilium.io
  - ciliumnetworkpolicies.cilium.io
  - ciliumnodes.cilium.io
  - ciliumnodeconfigs.cilium.io
- apiGroups:
  - cilium.io
  resources:
  - ciliumloadbalancerippools
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumloadbalancerippools/status
  verbs:
  - patch
# For cilium-operator running in HA mode.
#
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
# between multiple running instances.
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
# common and fewer objects in the cluster watch "all Leases".
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - update
---
# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
- kind: ServiceAccount
  name: "cilium"
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
- kind: ServiceAccount
  name: "cilium-operator"
  namespace: kube-system
---
# Source: cilium/templates/cilium-agent/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cilium-config-agent
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
---
# Source: cilium/templates/cilium-agent/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cilium-config-agent
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-config-agent
subjects:
  - kind: ServiceAccount
    name: "cilium"
    namespace: kube-system
---
# Source: cilium/templates/hubble/peer-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: hubble-peer
  namespace: kube-system
  labels:
    k8s-app: cilium
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: hubble-peer
spec:
  selector:
    k8s-app: cilium
  ports:
  - name: peer-service
    port: 443
    protocol: TCP
    targetPort: 4244
  internalTrafficPolicy: Local
---
# Source: cilium/templates/cilium-agent/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cilium
  namespace: kube-system
  labels:
    k8s-app: cilium
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-agent
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
  template:
    metadata:
      annotations:
        # Set app AppArmor's profile to "unconfined". The value of this annotation
        # can be modified as long users know which profiles they have available
        # in AppArmor.
        container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined"
        container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined"
        container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined"
        container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined"
      labels:
        k8s-app: cilium
        app.kubernetes.io/name: cilium-agent
        app.kubernetes.io/part-of: cilium
    spec:
      containers:
      - name: cilium-agent
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        command:
        - cilium-agent
        args:
        - --config-dir=/tmp/cilium/config-map
        startupProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9879
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          failureThreshold: 105
          periodSeconds: 2
          successThreshold: 1
        livenessProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9879
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          periodSeconds: 30
          successThreshold: 1
          failureThreshold: 10
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9879
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          periodSeconds: 30
          successThreshold: 1
          failureThreshold: 3
          timeoutSeconds: 5
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_CLUSTERMESH_CONFIG
          value: /var/lib/cilium/clustermesh/
        - name: CILIUM_CNI_CHAINING_MODE
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: cni-chaining-mode
              optional: true
        - name: CILIUM_CUSTOM_CNI_CONF
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: custom-cni-conf
              optional: true
        lifecycle:
          postStart:
            exec:
              command:
              - "bash"
              - "-c"
              - |
                /cni-install.sh --enable-debug=false --cni-exclusive=true --log-file=/var/run/cilium/cilium-cni.log
          preStop:
            exec:
              command:
              - /cni-uninstall.sh
        securityContext:
          seLinuxOptions:
            level: s0
            type: spc_t
          capabilities:
            add:
              - CHOWN
              - KILL
              - NET_ADMIN
              - NET_RAW
              - IPC_LOCK
              - SYS_MODULE
              - SYS_ADMIN
              - SYS_RESOURCE
              - DAC_OVERRIDE
              - FOWNER
              - SETGID
              - SETUID
            drop:
              - ALL
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        # Unprivileged containers need to mount /proc/sys/net from the host
        # to have write access
        - mountPath: /host/proc/sys/net
          name: host-proc-sys-net
        # Unprivileged containers need to mount /proc/sys/kernel from the host
        # to have write access
        - mountPath: /host/proc/sys/kernel
          name: host-proc-sys-kernel
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          # Unprivileged containers can't set mount propagation to bidirectional
          # in this case we will mount the bpf fs from an init container that
          # is privileged and set the mount propagation from host to container
          # in Cilium.
          mountPropagation: HostToContainer
        - name: cilium-run
          mountPath: /var/run/cilium
        - name: etc-cni-netd
          mountPath: /host/etc/cni/net.d
        - name: clustermesh-secrets
          mountPath: /var/lib/cilium/clustermesh
          readOnly: true
          # Needed to be able to load kernel modules
        - name: lib-modules
          mountPath: /lib/modules
          readOnly: true
        - name: xtables-lock
          mountPath: /run/xtables.lock
        - name: hubble-tls
          mountPath: /var/lib/cilium/tls/hubble
          readOnly: true
        - name: tmp
          mountPath: /tmp
      initContainers:
      - name: config
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        command:
        - cilium
        - build-config
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        terminationMessagePolicy: FallbackToLogsOnError
      # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
      # We use nsenter command with host's cgroup and mount namespaces enabled.
      - name: mount-cgroup
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        env:
        - name: CGROUP_ROOT
          value: /run/cilium/cgroupv2
        - name: BIN_PATH
          value: /opt/cni/bin
        command:
        - sh
        - -ec
        # The statically linked Go program binary is invoked to avoid any
        # dependency on utilities like sh and mount that can be missing on certain
        # distros installed on the underlying host. Copy the binary to the
        # same directory where we install cilium cni plugin so that exec permissions
        # are available.
        - |
          cp /usr/bin/cilium-mount /hostbin/cilium-mount;
          nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT;
          rm /hostbin/cilium-mount
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
        - name: cni-path
          mountPath: /hostbin
        terminationMessagePolicy: FallbackToLogsOnError
        securityContext:
          seLinuxOptions:
            level: s0
            type: spc_t
          capabilities:
            add:
              - SYS_ADMIN
              - SYS_CHROOT
              - SYS_PTRACE
            drop:
              - ALL
      - name: apply-sysctl-overwrites
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        env:
        - name: BIN_PATH
          value: /opt/cni/bin
        command:
        - sh
        - -ec
        # The statically linked Go program binary is invoked to avoid any
        # dependency on utilities like sh that can be missing on certain
        # distros installed on the underlying host. Copy the binary to the
        # same directory where we install cilium cni plugin so that exec permissions
        # are available.
        - |
          cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
          nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
          rm /hostbin/cilium-sysctlfix
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
        - name: cni-path
          mountPath: /hostbin
        terminationMessagePolicy: FallbackToLogsOnError
        securityContext:
          seLinuxOptions:
            level: s0
            type: spc_t
          capabilities:
            add:
              - SYS_ADMIN
              - SYS_CHROOT
              - SYS_PTRACE
            drop:
              - ALL
      # Mount the bpf fs if it is not mounted. We will perform this task
      # from a privileged container because the mount propagation bidirectional
      # only works from privileged containers.
      - name: mount-bpf-fs
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        args:
        - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
        command:
        - /bin/bash
        - -c
        - --
        terminationMessagePolicy: FallbackToLogsOnError
        securityContext:
          privileged: true
        volumeMounts:
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          mountPropagation: Bidirectional
      - name: clean-cilium-state
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        command:
        - /init-container.sh
        env:
        - name: CILIUM_ALL_STATE
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: clean-cilium-state
              optional: true
        - name: CILIUM_BPF_STATE
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: clean-cilium-bpf-state
              optional: true
        terminationMessagePolicy: FallbackToLogsOnError
        securityContext:
          seLinuxOptions:
            level: s0
            type: spc_t
          capabilities:
            add:
              - NET_ADMIN
              - SYS_MODULE
              - SYS_ADMIN
              - SYS_RESOURCE
            drop:
              - ALL
        volumeMounts:
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          # Required to mount cgroup filesystem from the host to cilium agent pod
        - name: cilium-cgroup
          mountPath: /run/cilium/cgroupv2
          mountPropagation: HostToContainer
        - name: cilium-run
          mountPath: /var/run/cilium
        resources:
          requests:
            cpu: 100m
            memory: 100Mi # wait-for-kube-proxy
      # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent
      - name: install-cni-binaries
        image: "{{cilium.registry}}/cilium:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        command:
          - "/install-plugin.sh"
        resources:
          requests:
            cpu: 100m
            memory: 10Mi
        securityContext:
          seLinuxOptions:
            level: s0
            type: spc_t
          capabilities:
            drop:
              - ALL
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
          - name: cni-path
            mountPath: /host/opt/cni/bin
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccount: "cilium"
      serviceAccountName: "cilium"
      automountServiceAccountToken: true
      terminationGracePeriodSeconds: 1
      hostNetwork: true
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                k8s-app: cilium
            topologyKey: kubernetes.io/hostname
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - operator: Exists
      volumes:
        # For sharing configuration between the "config" initContainer and the agent
      - name: tmp
        emptyDir: {}
        # To keep state between restarts / upgrades
      - name: cilium-run
        hostPath:
          path: /var/run/cilium
          type: DirectoryOrCreate
        # To keep state between restarts / upgrades for bpf maps
      - name: bpf-maps
        hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
      # To mount cgroup2 filesystem on the host
      - name: hostproc
        hostPath:
          path: /proc
          type: Directory
      # To keep state between restarts / upgrades for cgroup2 filesystem
      - name: cilium-cgroup
        hostPath:
          path: /run/cilium/cgroupv2
          type: DirectoryOrCreate
      # To install cilium cni plugin in the host
      - name: cni-path
        hostPath:
          path:  /opt/cni/bin
          type: DirectoryOrCreate
        # To install cilium cni configuration in the host
      - name: etc-cni-netd
        hostPath:
          path: /etc/cni/net.d
          type: DirectoryOrCreate
        # To be able to load kernel modules
      - name: lib-modules
        hostPath:
          path: /lib/modules
        # To access iptables concurrently with other processes (e.g. kube-proxy)
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
        # To read the clustermesh configuration
      - name: clustermesh-secrets
        secret:
          secretName: cilium-clustermesh
          # note: the leading zero means this number is in octal representation: do not remove it
          defaultMode: 0400
          optional: true
      - name: host-proc-sys-net
        hostPath:
          path: /proc/sys/net
          type: Directory
      - name: host-proc-sys-kernel
        hostPath:
          path: /proc/sys/kernel
          type: Directory
      - name: hubble-tls
        projected:
          # note: the leading zero means this number is in octal representation: do not remove it
          defaultMode: 0400
          sources:
          - secret:
              name: hubble-server-certs
              optional: true
              items:
              - key: ca.crt
                path: client-ca.crt
              - key: tls.crt
                path: server.crt
              - key: tls.key
                path: server.key
---
# Source: cilium/templates/cilium-operator/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cilium-operator
  namespace: kube-system
  labels:
    io.cilium/app: operator
    name: cilium-operator
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-operator
spec:
  # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go
  # for more details.
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        io.cilium/app: operator
        name: cilium-operator
        app.kubernetes.io/part-of: cilium
        app.kubernetes.io/name: cilium-operator
    spec:
      containers:
      - name: cilium-operator
        image: "{{cilium.registry}}/operator-generic:{{cilium.version}}"
        imagePullPolicy: IfNotPresent
        command:
        - cilium-operator-generic
        args:
        - --config-dir=/tmp/cilium/config-map
        - --debug=$(CILIUM_DEBUG)
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_DEBUG
          valueFrom:
            configMapKeyRef:
              key: debug
              name: cilium-config
              optional: true
        livenessProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9234
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 3
        volumeMounts:
        - name: cilium-config-path
          mountPath: /tmp/cilium/config-map
          readOnly: true
        terminationMessagePolicy: FallbackToLogsOnError
      hostNetwork: true
      restartPolicy: Always
      priorityClassName: system-cluster-critical
      serviceAccount: "cilium-operator"
      serviceAccountName: "cilium-operator"
      automountServiceAccountToken: true
      # In HA mode, cilium-operator pods must not be scheduled on the same
      # node as they will clash with each other.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                io.cilium/app: operator
            topologyKey: kubernetes.io/hostname
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - operator: Exists
      volumes:
        # To read the configuration from the config map
      - name: cilium-config-path
        configMap:
          name: cilium-config
---
# Source: cilium/templates/cilium-secrets-namespace.yaml
# Only create the namespace if it's different from Ingress secret namespace or Ingress is not enabled.
